火山引擎图片生成

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:45 AM UTC
• Version: 1.0.0

Overview

This skill coherently generates images through Volcengine and saves them locally, with one credential-handling hardening issue users should avoid.

Install only if you are comfortable sending image prompts to Volcengine and saving generated files locally. Set ARK_API_KEY as an environment variable or secret, do not pass it on the command line, avoid sensitive prompts, and consider adding URL validation and a download timeout before using this in automated workflows.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: volc_image.py:9

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: volc_image.py, lines 9–13
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

# Try to obtain the key from command-line arguments
for arg in sys.argv[1:]:
    if arg.startswith('ARK_API_KEY='):
        api_key = arg.split('=', 1)[1]
        os.environ['ARK_API_KEY'] = api_key
        break

Technical Analysis

The script permits the Volcengine Ark API key to be supplied as a command-line argument. Process arguments are not an appropriate secret-transport mechanism because they may be visible through process-monitoring interfaces, diagnostic and automation logs, command auditing, or shell history.

This behavior exceeds the minimum privileges and exposure necessary for the declared image-generation functionality. The script already supports retrieving the key from the ARK_API_KEY environment variable, so command-line credential parsing is unnecessary.

The subsequent transmission of the key in an HTTPS Authorization header to the declared Volcengine endpoint is consistent with the Skill's functionality and is not, by itself, evidence of unauthorized exfiltration.

Attack Path

1. A user invokes the Skill with a command such as:

   bash

   python volc_image.py ARK_API_KEY=<secret> "image prompt"
   

2. The complete command may be retained in shell history, CI/CD output, task-runner logs, endpoint-monitoring records, or other diagnostic systems.
3. While the process is running, a local account or monitoring component with permission to inspect its command line may read the argument.
4. The observer extracts the Ark API key.
5. The exposed key can be reused against Volcengine APIs within the permissions, quota, and lifetime assigned to that credential.

Impact Assessment

Successful exploitation exposes the confidentiality of the Ark API key. An attacker could authenticate to Volcengine with the victim's credenti ...[truncated 349 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove support for parsing ARK_API_KEY= from sys.argv.
2. Obtain the key only from ARK_API_KEY or, preferably, an operating-system or deployment-platform secret manager.
3. Fail securely with a concise error if the protected credential source is unavailable.
4. Update usage documentation so it never recommends placing secrets in command-line arguments.
5. Avoid printing, logging, or embedding the key in exception messages.
6. Configure CI/CD and production environments to inject the credential as a masked secret.
7. Rotate any API key that has previously been supplied through command-line arguments, especially where shell history or execution logs may have retained it.
8. Assign the API key only the Volcengine permissions and quotas required for image generation.

A hardened credential-loading pattern would be:

python

api_key = os.environ.get("ARK_API_KEY")
if not api_key:
    print("Error: ARK_API_KEY is not configured.")
    sys.exit(1)

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tainted flow: 'headers' from os.environ.get (line 37, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · volc_image.py (reported line 52)May include surrounding context.

python

}

try:
    response = requests.post(url, headers=headers, json=data, timeout=120)
    result = response.json()
    
    if 'data' in result and len(result['data']) > 0:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill performs network access and reads a secret from the environment, but the manifest does not declare any corresponding tool scope or permission boundary. This makes the skill's real capabilities less visible to users and reviewers, increasing the chance of unintended secret use or outbound requests without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explains image generation but does not clearly warn that the skill will automatically fetch a returned URL and write a local file. Users may disclose prompts to a third party and cause local disk writes without understanding those side effects, which is especially risky in agentic environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation wording is broad enough to trigger on ordinary image-related conversation, which can cause the skill to run in situations where the user did not intend to invoke external API usage and file writes. Because the skill sends prompts to a third party and downloads content, overbroad triggering raises privacy and safety risk beyond a simple UX issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The code transmits user-supplied prompts and an API-authenticated request to an external service, which is an actual data egress path. In this skill's context that behavior is expected, but it is still security-relevant because sensitive prompts or derived data may be sent off-host and the subsequent download step trusts a remote URL without additional validation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

}

# 发送请求
response = requests.post(url, headers={
    'Authorization': f'Bearer {api_key}',
    'Content-Type': 'application/json'
}, json=data)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Accepting API credentials through command-line arguments exposes secrets through shell history, process listings, job logs, and orchestration metadata. This creates avoidable credential leakage risk unrelated to the core image-generation function.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · volc_image.py (reported line 52)May include surrounding context.

python

}

try:
    response = requests.post(url, headers=headers, json=data, timeout=120)
    result = response.json()
    
    if 'data' in result and len(result['data']) > 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

User-provided prompts are transmitted to an external third-party API, but the script gives no explicit warning that prompt contents leave the local environment. If users include confidential, personal, or regulated data in prompts, this can result in unintended data disclosure to the provider.

Content

No source excerpt is available for this finding.

Tainted flow: 'img_url' from requests.post (line 56, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 93% confidence

Finding

The script downloads a URL returned by the external API without validating the hostname, scheme, or content type. If the upstream service is compromised or returns attacker-controlled URLs, this can trigger unintended outbound requests and retrieval of arbitrary content, creating an SSRF-style pivot or unsafe file download path.

Content

Scanner excerpt · volc_image.py (reported line 61)May include surrounding context.

python

print(f"URL: {img_url}")
        
        # 下载图片
        img_response = requests.get(img_url)
        if img_response.status_code == 200:
            # 保存到当前目录
            timestamp = int(time.time())

Static analysis

No suspicious patterns detected.